feat: implement governed cases workspace

src/govoplan_cases/backend/acl.py

@@ -0,0 +1,30 @@
+from __future__ import annotations
+
+from govoplan_core.auth import has_scope
+from govoplan_core.core.modules import AccessDecision
+
+
+class CaseAclProvider:
+    """Expose the tenant-level Case permission boundary to generic consumers."""
+
+    resource_type = "case"
+
+    def can_read(self, principal: object, resource_id: str) -> bool:
+        del resource_id
+        return has_scope(principal, "cases:case:read")
+
+    def can_write(self, principal: object, resource_id: str) -> bool:
+        del resource_id
+        return has_scope(principal, "cases:case:update")
+
+    def explain(self, principal: object, resource_id: str) -> AccessDecision:
+        del resource_id
+        allowed = self.can_read(principal, "")
+        return AccessDecision(
+            allowed=allowed,
+            reason=None if allowed else "Missing scope: cases:case:read",
+            requirements=("cases:case:read",),
+        )
+
+
+__all__ = ["CaseAclProvider"]